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FOREWORD 


This  report  was  prepared  by  James  D.  LaRue  of  the  Guidance  Section,  Guidance  and 
Control  Branch.  Systems  Analysis  Division,  Directorate  of  Advanced  Systems  Planning, 
Deputy  for  Technology,  Aeronautical  Systems  Division,  Wright-Patterson  AFB,  Ohio.  The 
work  was  accomplished  under  Project  No.  5401,  “Advanced  Systems  Synthesis  and  Analy¬ 
sis  Methods.’’ 

This  report  was  originally  submitted  by  the  author  in  partial  fulfillment  of  the  require¬ 
ments  for  the  degree  of  Master  of  Science  in  Electrical  Engineering.  The  studies  present¬ 
ed  began  in  March  1962  and  were  concluded  in  September  1962. 
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ABSTRACT 


The  probability  of  succeas  equations  for  redundant  networks  are  derived  from  basic 
component  failure  statistics.  The  components  have  two  modes  of  failure,  open  or  short. 
The  report  calculates  the  equations  for  four  basic  redundant  networks.  A  network  is  then 
designed  based  upon  these  results.  The  reliability  of  this  network  is  calculated  and  com¬ 
pared  to  several  other  designs. 

Publication  of  this  technical  documentary  report  does  not  constitute  Air  Force  approv¬ 
al  of  the  report’s  findings  or  conclusions.  It  is  published  only  for  the  exchange  and  stimu¬ 
lation  of  ideas. 


,^LYLE  H.  CORSAW 

Acting  Chief,  Systems  Analysis  Division 
Directorate  of  Advanced  Systems  Division 
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DEFINITIONS 

PenBlty  Function,  f(t)  -  The  probability  that  an  event  of  a  given  random  variable  will  occur, 
expressed  as  a  function  of  that  variable. 

Disjoint  -  Two  events  are  disjoint  if  the  occurrence  of  one  excludes  the  occurrence  of  the 
other. 

Distribution  Function.  F  (t>  -  The  probability  that  in  a  random  event,  the  random  variable 
is  not  greater  than  some  designate  value. 

Failure  -  The  event  of  unsatisfactory  response  of  a  component  or  device.  The  failure  of 
a  resistor  can  be  specified  quite  easily  whereas  the  failure  of  a  computer  is  quite  diffi¬ 
cult  to  specify  due  to  the  large  number  of  possible  modes  of  unsatisfactory  response. 

Failure  Rate  -  The  ratio  ci  the  prc^bility  that  failure  occurs  in  the  interval,  given  that 
it  has  not  occurred  prior  to  t,  the  stert  of  the  interval,  divided  by  the  interval  lengdi.  The 
formula  for  failure  rate  is 


P  (t)  -  P  (t  t  At) 

At  .  P(t) 

Hazard  Rate,  z  (t)  -  Also  called  instantaneous  failure  rate.  Defined  as  the  limit  of  the 
failure  rate  as  the  interval  len(^  approaches  zero. 

z  (t)  -  lim  P  (t)  -  P  (t  At)  ■  f  (t) 

At-.o  At*  P(t)  P(t) 

Mean  time  between  failures.  MTBF  -  The  arithmetic  average  of  the  time  to  failure  of 
all  the  items  considered.  This  mean  value  has  meaning  only  when  the  distribution  function 
of  the  failures  is  known. 

Probability  of  Success.  P  (s)  -  The  ratio  of  favorable  events  to  total  events. 

Random  Process  -  An  ensemble  of  time  functions 

-  ■<t<*.  k>l,  2,  3...  such  that  the  ensemble  can  be  characterized  through  sutisti- 
cal  properties. 

Redundancy  -  The  condition  which  exists  if  an  element  can  fail  in  a  network  and  the  net¬ 
work  continues  to  function.  If  elements  are  switched  in  and  out  of  the  circuit  the  redundan¬ 
cy  is  known  as  passive.  If  the  elements  are  energized  until  failure,  the  redundancy  is 
known  as  active. 

ReliaMli^,  P  (t)  -  The  probabtlity  that  a  device  will  operate  successfully  for  a  given 
period  of  time  when  operated  under  specified  condltioos. 
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INTRODUCTION 


A  method  of  applying  probability  theory  to  design  procedures  is  presented.  An  in¬ 
creasing  percentage  of  electronic  equipment  designed  today  must  meet  some  standard 
of  satisfactory  operation.  The  design  engineer  must  design  his  equipment  to  reach  or 
exceed  a  definite  reliability  goal.  This  goal  can  be  a  specified  mean  time  to  failure  or 
a  probability  of  successfully  operating  a  given  number  of  hours.  It  is  the  intent  of  this 
report  to  review  the  current  accepted  techniques  in  predicating  reliability  of  electronic 
equipment  and  then  use  probability  theory  to  design  networks  which  are  extremely  re¬ 
liable  as  compared  to  conventionally  designed  networks. 

CURRENT  TECHNIQUES 

Reliability  is  a  relatively  new  science.  The  first  concerted  effort  to  gather  failure 
data  was  started  early  in  1950.  By  1955  prediction  techniques  were  formulated  using 
the  statistics  generated  by  the  collection  of  failure  data.  B.  Epstein  of  Wayne  University 
and  M,  Sobel  of  Bell  Telephone  Laboratories  did  much  of  the  early  sifting  of  these  failure 
statistics.  Arinc  Research  Corporation  acting  on  behalf  of  commercial  airlines  was  very 
active  in  these  early  investigations.  It  was  already  known  by  1950  that  the  times  of  wear 
out  failure  followed  a  normal  distribution.  A  great  amount  of  information  is  implied  in 
the  statement  “times  of  wear  out  failure  followed  a  normal  distribution.’’  The  length  of 
life  of  an  Incandescence  light  bulb  is  a  random  variable.  The  standard  method  of  describ¬ 
ing  a  random  variable  such  as  bulb  life  is  to  state  the  probability  of  the  light  bulb  reach¬ 
ing  or  exceeding  some  value  of  bulb  life,  in  other  words,  what  is  the  probability  that  a 
given  50  watt  light  bulb  will  operate  at  least  500  hours  when  operated  under  standard  con¬ 
ditions.  The  random  variable  is  bulb  life;  the  random  event  is  the  failure  of  the  bulb  to 
work?  If  a  large  number  of  bulbs  are  placed  on  life  test,  time  of  the  failure  being  record¬ 
ed,  the  mean  life  and  dispersion  around  the  mean  can  be  calculated.  The  probability  of  a 
50  watt  bulb  reaching  500  hours  is  then  the  ratio  of  bulbs  operating  at  500  hours  to  the 
total  number  starting  the  test.  The  piot  of  probability  of  reaching  some  value  of  time  as 
a  function  of  time  is  known  as  the  cumulative  distribution  function.  The  word  “normal’’  de¬ 
scribes  a  particular  shape  to  this  plot.  Bearings,  clutches,  motor  brushes,  internal  com¬ 
bustion  engines  all  have  failure  records  which  support  the  wear  out  -  normal  distribution 
relationship.  Wear  out  failures  are  not  the  only  type  of  failures  to  occur.  For  example, 
with  car  tires  one  type  of  failure  is  the  wearing  off  of  tread.  A  second  type  of  failure  is 
caused  by  road  hazards.  If  a  tire  runs  over  a  road  hazard,  a  blow-out  occurs.  The  first 
type  of  failure  follows  a  normal  distribution  with  the  random  variable  being  mileage  ra¬ 
ther  than  time.  The  second  type  of  failure  is  characterized  by  having  a  constant  risk.  The 
constant  risk  implies  that  there  are  a  fixed  number  of  road  hazards  per  1000  miles.  This 
number  of  hazards  is  not  a  function  of  the  number  of  miles  driven.  A  random  event  which 
is  associated  with  a  constant  risk  can  be  shown  to  possess  an  exponential  probability  func¬ 
tion. 

But  resistors,  capacitors,  semiconductors,  and  other  electronic  components  do  not 
wear  out  in  the  accepted  sense  that  something  is  worn  or  eroded  away.  Yet  random 
failures  of  these  components  do  occur. 

Sobel  and  Epstein  have  written  several  papers  dealing  with  the  statistics  of  life  test¬ 
ing.  The  random  variable  recorded  during  life  testing  is  the  time  of  failure  of  the  device. 


Manuscript  released  by  the  author  14  December  1962  for  publication  as  an  ASD  Technical 
Documenury  Report. 
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When  electronic  equipment  is  placed  in  life  test  under  the  environment  for  which  it  was 
designed,  the  time  of  failure  is  distributed  in  accordance  with  the  exponential  probability 
distribution  function. 

Figure  1  illustrates  the  normal  distribution  and  the  exponential  distribution  as  well  as 
illustrating  values  of  terms  commonly  used  in  reliability.  For  both  the  normal  and  the  ex¬ 
ponential  life  test  90  items  were  placed  on  test. 

The  data  for  figure  1  is  not  from  a  real  test;  therefore,  the  resulting  curves  are  more 
nearly  perfect  than  would  be  expected  from  actual  life  tests.  The  number  of  failures  which 
occurr^  during  each  hour  of  operation  is  given.  Failure  rate  is  the  ratio  of  units  failed 
during  the  hour  Interval  to  the  number  of  units  entering  the  hour.  The  sum  of  survival  rate 
and  failure  rate  is  unity.  Probability  of  survival  is  the  ratio  of  units  surviving  the  hour  to 
the  total  number  of  units  starting  the  test. 

Before  examing  the  failure  data  of  several  electronic  systems  the  method  of  validating 
the  postulated  distribution  of  the  random  failures  must  be  explained.  One  method  of  accept¬ 
ing  or  rejecting  the  postulated  distribution  is  known  as  the  Kolmogorov-Smimov  one  sam¬ 
ple  test.  The  method  involves  tabulating  the  cumulative  distribution  functions,  survival 
curve  figure  1,  of  the  actual  failure  data  and  the  postulated  cumulative  distribution  function. 
It  can  be  shown  that  the  absolute  difference  between  the  two  functions  is  itself  a  random 
variable  with  a  known  distribution.  The  method  is  called  one  sample  because  the  maximum 
absolute  difference  is  calculated  and  serves  as  a  criteria  for  acceptance  or  rejection  of 
the  postulated  distribution.  The  maximum  absolute  difference  is  compared  to  a  table  of 
critical  values  of  difference  in  the  Kolmogorov-Smimov  one  sample  test.  L*  for  a  given 
sample  size  and  level  of  significance  the  maximum  absolute  difference  is  less  than  the 
tabular  value,  the  postulated  distribution  is  the  best  fit  that  can  be  had.  The  level  of  sig¬ 
nificance  is  an  indication  of  the  error  in  accepting  the  postulated  distribution  when  the 
postulated  distribution  should  be  rejected.  The  usual  value  for  this  is  0.05  or  5  times  out 
at  100  the  postulated  distribution  will  be  accepted  when  it  should  be  rejected. 

The  Radio  Corporation  of  America  in  conjunction  with  the  Air  Force  has  collected 
failure  data  on  hundreds  of  ground  based  electronic  systems.  Radar,  navigation,  and  com¬ 
munication  equipment  were  included  in  this  study.  Table  2  is  a  Kolmogorov-Smimov  one 
sample  test  for  an  AN/FPS-3,  ground  based  radar.  The  main  points  of  interest  are: 

(1)  Large  number  of  failure,  116 

(2)  Mean  life  55  hours,  6409/116  »  55  hr. 

(3)  The  exponential  distribution  fits  the  data. 

Figure  2  is  a  plot  of  probability  of  success  versus  operate  time.  The  exponential  is 
very  close  to  the  actual  data.  Arinc  Research  Corporation  investigated  the  AN/APS-20E 
airtome  radar.  Their  objective  was  to  modify  the  radar  such  that  the  radar  becomes  more 
reliable.  Figure  3  is  a  plot  of  four  curves,  two  exponential  and  two  observed.  The  unmodi¬ 
fied  and  the  modified  systems  are  seen  to  follow  an  exponential  distribution. 

Figure  4  is  a  plot  of  probability  of  success  for  a  vacuum  tube,  2D21W.  The  basic  ex¬ 
ponential  probability  of  success  is  very  closely  approximated.  This  data  came  from  re¬ 
liability  studies  of  electronic  equipment  on  the  USS  Forestal  during  1958  and  1959. 

The  concept  of  hazard  or  risk  was  discussed  with  failure  modes  of  tires.  The  mathe¬ 
matical  definition  at  hazard  is  “The  probability  that  a  failure  will  occur  in  the  next  in¬ 
stant  <rf  time,  assuming  previous  survival.”  Using  this  definition  equations  can  be 
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developed  which  relate  the  hazard  equation  to  the  reliability  function.  If  the  hazard  is  known 
to  have  some  function  of  time,  the  reliability  as  a  function  of  time  becomes  specified.  Sev¬ 
eral  component  manufacturers  have  investigated  the  hazard  function  of  their  components. 
The  following  equations  show  the  relation  between  a  constant  hazard  and  the  exponential 
reliability  function.  If  a  compoiMnt  manufacturer  can  show  a  reasonably  constant  hazard, 
then  the  assumption  of  an  exponential  failure  rate  is  valid.  In  reliability  literature  the  term 
failure  rate  is  utilized  rather  than  hazard.  Throughout  this  report  hazard  and  failure  rate 
will  be  used  interchangeably  although  failure  rate  is  an  incorrect  (mathematically  speak¬ 
ing)  concept. 

P^(t)  -  reliability  function  -  probability  of  success 

Pp(t)  -  unreliability  function  -  probability  of  failure 

PgCt)  +  Pp(t)  -  1  (1) 

dPa(t) 

— -n — ■  f(t)  -  probability  density  function  (2) 


f(tj)  dt  -  probability  of  failure  in  the  interval  dt  centered  at  t^ 
\(t)  -  hazard  or  failure  rate 


Hazard  is  a  conditional  probability  function  as  it  is  a  function  of  the  probability  of 
operating  to  a  given  time  coupled  with  the  probability  of  working  in  the  next  interval.  The 
relationship  between  hazard,  probability  density  function,  and  the  reliability  function  can 
be  developed  by  the  use  of  conditional  probability  theory.  This  approach  is  very  erudite 
and  not  in  line  with  the  Intent  of  this  work.  Therefore,  rather  than  including  several  pages 
of  abstract  mathematics  showing  the  relationship  between  hazard,  probability  density  func¬ 
tion,  and  reliability  function,  it  will  be  defined  as  the  ratio  of  the  probability  density  func¬ 
tion  to  the  reliability  function. 


X(t) 


f(t) 

PsCt) 


(3) 


If  the  hazard  is  constant,  then  equation  (3)  can  be  written  as: 
1  d  [  1  -  P  (t)  ] 


\dt 


-1 


P(t) 


.d[P(t)l 


Xt  --lnPg(t) 


PJt)  -  e 


Xt 


(4) 


(5) 


Where  P^(t)  is  the  probability  of  success  as  a  function  of  time  when  the  hazard  is  con¬ 
stant. 

The  mean  value,  j,,  of  a  random  variable  is  the  limit  of  the  sum  of  the  assumed  values 
when  each  value  is  multiplied  by  its  appropriate  probability  of  occurrence. 
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TABLE  2 

OBSERVED  AND  THEORETICAL  RELIABILITY  FUNCTIONS  FOR  AN/FPS-3 


TIME  OF  TEST - 
MEAN  LIFE  (ml 

6409  HOURS 
-S5  HOURS 

TRUE  FAILURES  -II 
d(mot)(0.09)  =  0.126 

6 

PERIOD 

CUMULATIVE 

FAILURES 

CUMULATIVE 

PROBABILITY 

THEORETICAL 

CUMULATIVE 

PROBABILITY 

ABSOLUTE 

VALUE 
p(o)  -  pit ) 

t  (hr) 

0 

p(o) 

pit): 

d 

0  or  mort 

116 

1.000 

1.000 

.000 

10  or  mort 

96 

.828 

.834 

.006 

20  or  mort 

77 

.664 

.695 

.031 

50  or  mort 

6  I 

.  S26 

.580 

.054 

40  or  mort 

S3 

.  457 

.  484 

.027 

SO  or  mort 

4S 

.388 

.  404 

.016 

60  or  mort 

58 

.328 

.  336 

.008 

70  or  mort 

29 

.  250 

.281 

.031 

80  or  mort 

21 

.  181 

.  235 

.0S4-d (mos) 

90  or  mort 

18 

.155 

.194 

.039 

1  00  or  mort 

IS 

.129 

.  162 

.033 

1 1  0  or  mort 

1  5 

.1  12 

.135 

.023 

1 2  0  or  mort 

1  I 

.  095 

.113 

.018 

1  50  or  mort 

lO 

.086 

.  094 

.008 

140  or  mort 

10 

.  086 

.  078 

.008 

ISO  or  mort 

10 

.086 

.  065 

.021 

1 60  or  mort 

8 

.069 

.  054 

.015 

1  70  or  mort 

8 

.069 

.  046 

.023 

180  or  mort 

7 

.060 

.  038 

.022 

190  or  mort 

6 

.  052 

.  032 

.020 

200  or  mort 

5 

.026 

.  026 

.000 

dlmOK)  :  0.054  d  (max  )I0.05)  ~  0.126 


Ther«fora,tht  obsarvad  cumulotiv*  probability  fits  Iht  thtoraticol  cumulativ*  probobility 
distribution  at  a  5  porcant  loval  of  significanca. 


5 


ASD-TDR-62-1072 


Figure  2.  Probability  of  Survival  Curvea  for  AN/FPS-3 
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TIME  TO  FAILURE,  IN  HOURS 

Figure  4.  JAN-5727/2D21 W  Reliability  Functions 
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Generalized  Transistor  Failure  Rate  Pattern 


(With  major  influencing  factors) 

Worlimonship 

Lsokt 

'  —  Surface  cleaning - 

-  Joints  and  cannectiane 

Atmosphere  control  -« 

Design 

—Thermal  cycling  fatigue 

Atmasphere  specification  — — 

-  Seol  and  mechanical  structure 
Application 

•  —  High  mechanical  stresses 
■  —  High  power  cycling  stresses  — — 
High  temperatures  — 

Circuit  design  margins - 


I  EARLY  CONSTANT  RANDOM  FAILURE  RATE 

FAILURE 


DEGRADATION 

FAILURE 


1  I  .  I  I  I  I  I  t  I 


TIME 


Figure  5.  Transistor  Failure  Rate  (General  Electric) 


9 


ASD-TDR-62-1072 


-CO 

ft  •  f(t)  dt 


i 


00  .^-Xt 
t  (-^)  dt 


_1 

X 


(6) 


The  mean  value  is  also  the  arithmentic  average.  T,  of  the  random  events.  This 
arithmetic  average  is  known  as  the  mean  time  before  failure.  MTBF. 

„.T.- 


-Xt 


■t/T 


(7) 


This  identity  is  used  throughout  the  report. 

Figure  S  presents  the  causes  of  failure  which  are  present  during  the  life  of  a  semi- 
ccMiductor.  The  curve  is  often  called  the  bath  tub  curve  for  obvious  reasons.  The  curve 
represents  the  experience  General  Electric  engineers  have  had  in  the  production  and 
life  testing  of  semiconductors. 

Figure  6  is  a  plot  of  failure  rate  for  several  Philco  transistors.  Figure  7  is  a  plot 
of  the  Kolmogorov-Smimov  test  for  exponentiality  of  the  2N496-2N495  2N1118-2N119. 

If  the  stepped  line  crosses  the  UCL.  the  hypothesis  of  exponential  failure  is  rejected. 
This  data  came  from  a  Philco  report  entitled  “Reliability  Report  on  the  Philco  SAT 
Transistors”  dated  1960. 

The  strong  belief  in  components  possessing  an  exponential  distribution  is  also  based 
upon  the  serial  nature  of  most  electronic  networks.  The  serial  nature  concept  has  one 
basic  assumption;  all  components  must  perform  satisfactorily  or  the  system  fails. 
Probability  ^eory  dictates  that  under  these  conditions  the  probability  of  success  of  the 
overall  system  is  the  product  of  the  individual  component  probabilities  of  success. 

P  (system)-  t— r  P.  (component)  (8) 

1  «'  I 

Ample  data  substantiates  that  the  system  probability  of  success  is  exponential.  The 
only  mathematical  form  which  P|  can  be  is  a  constant  or  an  exponential. 

Since  the  system  probability  of  success  is  the  product  of  the  individual  probabilities 
of  success  the  system  failure  rate  is  the  sum  of  the  individual  failure  rates  assuming  an 
eiqKmentlal  distribution. 


-X,t 

(9) 

N 

i”Xt^  .  g'ZXi* 

(10) 

i  -  1 
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ACCUMULATIVE  TRANSISTOR  TIME  IN  MILLIONS  OF  HOURS 
Figure  6.  Transistor  Failure  Rate  (Philco) 


ACCUMULATIVE  TRANSISTOR  TIME  IN  MILLIONS  OF  HOURS 


Figure  7.  Kolmogorov -Smirnov  Test  for  Exponentiality 
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where  \y  -  system  failure  rate 

-  Nth  component  failure  rate 

The  failure  rate  of  each  type  of  component  is  obtained  either  from  the  component 
manufacturer,  life  test  data,  field  data  or  from  any  of  the  many  tabulated  listings  now 
available.  One  such  source  is  a  report  by  Arinc  Research  Corporation  entitled  ‘  ‘A  Re¬ 
liability  Study  of  Microwave  and  Transmitting  Tubes,  Semiconductors,  Relays  and  Other 
Parts,”  dated  September  30,  1960. 

What  ultimately  determines  the  validity  of  the  exponential  distribution  as  a  reliability 
predictor,  that  is  the  summing  of  individual  failure  rates  to  form  system  failure  rate, 
is  the  designing  of  a  complex  electronic  device  to  a  definite  reliability  goal.  In  1959  the 
Radio  Corporation  of  America  agreed  to  build  for  the  Air  Force  an  airborne  data  link 
which  had  to  possess  a  minimum  acceptable  mean  time  to  failure  of  200  hours.  At  the  end 
of  10,120  hours  of  accumulated  test  hours  the  calculated  mean  time  to  failure  was  211 
hours. 


PURPOSE 

Siqjpose  the  design  engineer  is  given  the  task  of  designing  an  electric  network  which 
must  exhibit  a  minimum  acceptable  probability  of  success.  This  implies  that  the  network’s 
failure  rate,  summed  up  from  all  components,  must  be  below  some  value.  For  purposes 
of  discussion  the  design  engineer  is  using  failure  rate  data  which  is  up  to  date  and  ac¬ 
curately  represents  the  components  he  will  use.  The  problem  arises  when  the  summed 
failure  rate  is  greater  than  the  accepuble  failure  rate. 

In  the  last  several  years  this  problem  has  arisen  and  has  been  solved  by  using  passive 
redundancy.  In  redundant  design  tliose  subsystems  which  have  a  high  failure  rate  are 
either  placed  in  parallel  or  series  and  switched  on  and  off  as  needed.  Thus,  early  effort 
in  redundancy  centered  upon  complete  assemblies,  for  example  two  complete  photo  elec¬ 
tric  tubes  and  associated  circuitry  were  used  in  star  trackers,  if  phototube  A  failed,  then 
phototube  B  was  switched  on  to  operation.  Generators  and  motors  fall  into  this  category. 

This  technique  works  for  certain  items;  however,  in  an  airborne  digital  computer 
which  employs  8,000  transistors.  24.000  resistors,  32,000  diodes,  7,000  capacitors  none 
stand  out  as  critical  or  frequent  failures.  Should  the  entire  computer  be  duplicated  and 
carried  as  a  spare?  Or  should  the  individual  resistors,  capacitors,  transistors,  and  others 
be  made  redundant  so  that  failures  of  individual  components  will  not  cause  network  fail¬ 
ure? 

The  present  accepted  method  of  analyzing  the  gains  in  reliability  due  to  redundancy 
considers  all  failures  are  identical.  This  was  adequate  for  passive  redundancy  where 
the  failed  element  is  switched  out  of  the  circuit.  In  active  redundancy  failed  elements  are 
not  switched  out,  but  remain  in  the  circuit.  It  is  quite  clear  that  the  mode  of  failure  of 
an  actively  redundanded  element  affects  the  operation  of  the  network.  For  exanq>le,  par¬ 
alleling  of  diodes  is  one  example  of  active  redundancy.  If  a  diode  shorts,  then  the  net  has 
failed;  however,  an  ojxen  diode  still  permits  network  operation.  In  this  report  redundant 
networks  are  examined  and  the  probability  of  success  equations  are  derived  on  the  basis 
that  some  elements  will  fail  in  an  open  or  short. 
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REDUNDANT  NETWORKS 
Probability  of  Success  Equations 

The  usual  form  of  redundancy  consists  of  two  or  more  identical  elements  arranged 
in  a  parallel  or  aeries  configuration.  If  the  mode  of  failure  is  a  short,  then  two  elements 
in  series  constitute  redundancy,  if  the  mode  of  failure  is  an  open,  then  two  elements  in 
parallel  constitute  redundancy. 


probability  of  short 
probability  of  open 


Figure  8  -  Parallel  Network 


Ps”^~<l8~4o  Probability  of  success  of  each  element.  Two  arithmetic  operations 
used  frequently  in  probability  are  P(A  B)  and  P(A.B).  P(A  4-  B)  denotes  the  probability 
that  either  A  or  B  or  both  occur.  P(A.B)  denotes  the  Joint  probability  that  both  A  and  B 
occur. 


P(A  +  B)  -  P(A)  ♦  P(B)  -  P(A,B)  (11) 

P(A.B)  -  P(A)  •  P(B/A)  •  P(B)  •  P(A/B)  (12) 

P(B/A)  is  the  probability  oi  B  occurring,  given  that  A  has  occurred. 

Two  events  are  said  to  be  mutually  exclusive  if 

P(A.B)  -  0  (13) 

Thus 

P(A  +  B)  -  P(A)  +  P(B)  (14) 

Two  such  events  are  mutually  independent  if 

P(A.B)  -  P(A)  .  P(B)  (15) 

By  definition  tig  .  q^  ■  0  since  one  element  cannot  open  or  short. 


To  determine  the  probability  of  success  or  its  equivalent  the  probability  of  failure  of 
any  network,  the  problem  is  to  form  a  list  of  all  events  which  will  cause  the  network  to 
perform  successfully  or  unsuccessfully  depending,  of  course,  upon  which  probability  is 
being  formulated.  If  both  probabilities  are  formulated,  then  none  of  the  terms  in  one  list 
will  appear  in  the  other.  Mathematically  these  lists  or  sets  are  said  to  be  mutually  ex¬ 
clusive.  The  individual  lists  must  comprise  all  the  events  leading  to  the  particular  mode 
being  formulated.  If  a  list  is  complete,  then  the  list  is  said  to  be  exhaustive.  The  term 
disjoint  is  used  interchangeably  with  mutually  exclusive.  It  may  be  easier  to  form  an  ex¬ 
haustive  set  of  disjoint  events  comprising  successful  operation  or  it  may  be  simpler  to 
operate  on  the  failure  events.  With  the  parallel  configuration  it  is  easier  to  work  with 
failures  since  two  mutually  exclusive  events  form  an  exhaustive  set  of  failures. 


Let  a  represent  the  probability  that  element  1  or  11  shorts 
Let  fi  represent  the  probability  that  both  element  1  and  11  opens. 
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Then  the  probability  of  failure,  Pp,  of  figure  8  is 


Pp  -  at  +  ^  (16) 

tt-qg+qg-qg*  (17) 

Ps-(^-V*-V  (20) 


The  same  approach  is  used  for  figure  9. 


Figure  9  -  Series  Network 

The  exhaustive  set  of  disjoint  failures  is  arrived  at  as  follows: 

a  is  the  probability  that  element  1  or  II  opens. 

fi  is  the  probability  that  element  1  and  element  11  shorts 


Pp-a  +  ^  (21) 

(22) 

(23) 

Ps"(^*V-V  (24) 


The  series  parallel  network  presents  a  similar  problem. 


~[I)- 

-01— 1 

— 0- 

-1T3— 1 

Figure  10  •  Series  Parallel  Network 

It  can  be  shown  that  two  mutually  exclusive  failure  events  can  form  an  exhaustive  set, 
and  the  problem  may  be  solved  in  this  manner.  A  far  simpler  method  is  to  regard  figure 
10  as  a  series  network  such  as  figure  11. 


Figure  11  -  Serial  Representation 
Now  q^  of  unit  A  is  as  follows 

qg  (A)  -  tjg  (I)  +  qg  (II)  -  qg  (I) .  qg  (H)  (25) 
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Then  for  identical  units 

qg  (A)  -  q^  (B) 

(26) 

q,(A)-2q^-q^* 

(27) 

qo(A)-q^(B)-(^(I).q^(II).q^* 

(28) 

Substituting  equations  (27)  and  (28)  into  equation  (24)  yields  the  probability  of  success 
directly  as 

Pg  *  -  <2  Qg  -  qg*)’ 

(29) 

Ps.(l-q^»)>-rl-(l-2q^.  q^»)]» 

(30) 

Pg  -  (1  - 

(31) 

The  parallel  series  configuration,  figure  12,  can  be  solved  in  the  same  manner. 

I — CD — QD — I 


Figure  12  -  Parallel  Series 

Following  the  same  approach,  equation  (20)  which  was  developed  for  the  parallel  net 
work,  the  probability  of  success  equation  may  be  written  as 


(32) 

(1  -  q^.).  .  n  .  (1  -  q^).  T 

(33) 

Table  3  -  Redundant  Network  Equations 


Configuration 

Pg  Equation 

Minimizes 

Parallel 

(I-V'-V 

Opens 

Series 

(i-VV 

Shorts 

Series  Parallel 

(1  -  q^»)»  -  n  -  (1  -  qg)*l* 

Opens 

Parallel  Series 

(1  -qg*)’  ■  -d  -qo)*]» 

Shorts 
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The  series  parallel  network  is  sensitive  to  shorts.  This  can  be  shown  by  expanding 
equation  (31). 

Ps-(l-2q^».qo*)-(2qs  +  qs*)’  (34) 

dropping  3rd  order  terms  and  higher 

If  q^^  <  0.1  and  q^  <  0.1  the  approximation  is  valid  and  equation  (35)  shows  the  effects 
of  opera  and  shorts.  Depending  upon  the  relative  frequency  of  occurrence  of  shorts  and 
opens  of  a  particular  component  one  can  choose  the  redun^nt  configuration  which  yields 
optimum  reliability.  , 

The  equation  for  the  parallel  network  is  an  image  of  the  series  network.  By  putting  in 
q^  for  q^  and  q^  for  q^  in  the  parallel  case,  the  series  equation  results.  The  same  re¬ 
lation  holds  for  the  series  parallel  and  parallel  series.  We  will  use  this  identity  later  in 
the  report,  if  equations  are  developed  for  the  parallel  or  series  parallel  network,  they 
can  be  converted  to  the  series  or  parallel  series  by  the  above  process. 

Time  Dependent  Probability  of  Success  Equations 

To  derive  the  time  dependent  probability  of  success  equations  when  utilizing  components 
which  fall  in  two  modes,  a  brief  discussion  of  the  component’s  probability  of  success  equa¬ 
tions  is  necessary. 

The  probability  of  success  equation  derived  for  the  parallel  network  is: 

-  V  (20) 

To  express  the  probability  of  success  as  a  function  of  time,  q^  and  q^  should  be  ex¬ 
plicit  functions  of  time.  ^  ^ 

Multi-Mode  Exponential  Function 

It  is  known  that  the  components  used  in  the  network  have  two  failure  states,  open  or 
short.  It  is  postulated  that  the  distribution  of  failures  due  to  open  or  shorts  is  ejqponential 
in  nature.  The  form  of  the  probability  density  function  for  the  random  events  known  as 
shorts  and  the  random  events  kirawn  as  opens  will  now  be  derived. 

Two  equations  are  used  to  derive  these  probability  density  functions.  They  are: 

N 

1-^8+  I  qi  (36) 

1  -  1 

P  -  e'*/’^  (37) 

8 
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P„  is  the  probability  of  the  component  operating  successfully,  and  has  been  shown  to 
be  an  exponential  function,  qj  is  the  probability  of  failing  in  the  ith  mode.  The  sum  of  the 
probabilities  of  failing  in  all  disjoint  modes  plus  the  probability  of  success  (not  failing  in 
any  ot  the  above  modes)  must  equal  one. 

N 

P_  ■  1  -  where  P-  is  probability  of  success 


N 

£ 

i  ■  1 


-t/T 


N 

Ps--  £  qi 
i  -  1 


-t/T  N 


'^qi 

i  -  1 


is  the  exhaustive  sum  of  probability 
of  disjoint  of  failure  events 


known  (37) 


time  derivative  (38) 


(39) 


Consider  two  modes  of  failure  namely  that  of  open  or  short. 


-t/T 


*  % 


-  probability  of  open 
q^  -  probability  of  short 


(40) 


It  is  reasonable  to  postulate  that  ^  and  q^  must  be  exponential  since  the  left  hand  side 
of  equation  (40)  is  exponential.  Thererore,  q/and  6  are  assigned  an  ( 


<1  and  q^ 

with  an  arbitrary  coefficient  yet  to  be  determined. 

;  A  _-t/T 

Q  m  —  e 

'j' 


exponential  function 


(41) 


n  B  e'*/'^ 

q-  "  —  ® 

o 


(42) 


q^  .  A  (1  -  e'*/*^) 


(43) 
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q^  -  B  (1  -  e'*/’*') 

(44) 

Ps- 

(45) 

-  1  -(A  +  B)  (1  -  e’^'^’'^) 

(46) 

A  -v  B  ■  1 

(47) 

To  determine  A  and  B.  consider  N  units  are  on  life  test.  At  some  T,  M  units  will  have 
failed.  These  M  failures  are  comprised  of  O  opens  and  S  shorts.  If  q  is  the  probability 
of  having  a  failure  by  time  T 


,  -T/T  -  M 
q-  1  -e  ^  N 


(48) 

(49) 

(43) 


Now  Q  is  the  probability  of  having  an  open  at  time  T.  This  is  the  ratio  of  toul  units 
toTh 


on  test  to  the  units  having  opens  at  T. 


O  .  -T/T,  .  M 

q„-  —  ■A(l-e  '  )-A.— 
^  N  N 


A  O 

^•m 


(50) 


(51) 


Therefore  A  is  the  ratio  at  units  failed  to  units  failed  with  open.  B  can  be  written  as 

(52) 


B-l. 


M 

Given  test  data  on  a  particular  component  A  and  B  can  be  determined.  This  is  discussed 
in  the  section  on  Quad  Design. 

Redundant  Network  Equations 

The  probability  of  success  equations  for  the  parallel  and  series  networks  are 

Ps  -  -V  (20) 

Ps  "  (^  -  V)  ■  V  (25) 
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Pg  ■  ri  -  B(1  -  -  A»(l  -  (53) 

Pg  -  [  1  -  A(1  -  -  B»(l  -  (54) 

The  probability  of  success  equations  for  the  series  parallel  and  parallel  series  are 

s 

Once  again  direct  substitution  of  and  q^  yields 

Pg  -  [1  -  A»(l  -e"*/’^)*]*  -{l  -  ri-B  (l-e‘*^’*')]*}»  (55) 

Pg  -  ri  -  B»(l  -  e'*^**")*)*  -{l  -  [1-A(1  -e'*/’^)]»}»  (56) 

Table  4.  Time  Dependent  Redundant  Network  Equations 


Table  4.  Time  Dependent  Redundant  Network  Equations 


Network 

Reliability  Equation  Sensitivity 

Parallel 

Series 

Series  Parallel 

Parallel  Series 

[l-B(l-e"*/’^)]»-A»(l-e‘*''’*')»  Shorts 

tl-A(l-e*^/’^)]»-B»(l-e‘*/V  Opens 

[l-A®(l-e'*^^)»  -{ l-[l-B(l-e‘*'^^)]»}» 

Shorts 

[  l-B»(l-e‘^^^)»]®-{l-ri-A(l-e'^^’^)]»}» 

Opens 

Figures  13  -  17  plot  the  relationship  of  probability  of  success  versus  time  for  the 
single  unit,  parallel,  and  the  series  parallel  network.  While  the  points  are  plotted  to  twice 
the  mean  life  the  useful  portion  is  out  to  about  0.4  T. 

Figure  13  shows  that  the  parallel  network  is  superior  to  the  series  parallel  when  only 
opens  occ^,  A  -  1.  In  these  figures,  the  single  unit  is  represented  by  a  straight  line 
since  e"*/”  on  semi-log  paper  is  a  linear  function. 

Figure  14,  A  -  0.9,  B  »  0.1,  shows  the  series  parallel  unit  slightly  better  than  the 
parallel  unit.  As  the  probability  of  shorts  increases  the  series  parallel  unit  becomes  more 
reliable  than  the  parallel  unit.  The  series  parallel  unit  reaches  its  most  reliable  mode 
when  A  ■  0.7  and  B  ■  0.3.  These  values  are  taken  from  the  curves  rather  than  differen¬ 
tiating  equation  (55)  with  respect  to  A  and  setting  the  result  to  zero  and  solving  for  A 
which  gives  max  P  .  When  A  ■  0.5,  B  ■  0.5  the  parallel  unit  becomes  equivalent  to  a 
single  unit. 
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Figure  15.  Probability  of  Success  versus  Time,  A  =  0.  8 


22 


ASD-TDR-62-1072 

QUAD  NETWORK  THEORY 

The  purpose  of  this  section  is  the  orderly  development  of  the  probability  of  success 
equations  of  the  Quad.  The  quad  network  is  a  network  of  four  blocks  arranged  in  a  parallel- 
series  or  series-  parallel  mode.  These  blocks  may  be  identical  or  non -identical,  one- 
element  or  multi -element.  Figure  18  shows  the  two  basic  quad  networks  within  quad  net¬ 
works 


Figure  18.  Quad  Networks 

A  network  has  been  designed  and  built  both  in  an  unquaded  and  in  a  quaded  state  to 
show  the  results  of  quading.  This  network  is  shown  in  figure  19. 


OUTPUT 


Figure  19.  Impedance  Transformer  Network 

We  desire  to  make  this  network  as  reliable  as  possible.  Assume  that  this  network  is  a 
very  critical  link  in  a  satellite  transmitter.  One  way  to  increase  reliability  would  be  to 
parallel  two  identical  networks,  figure  20.  This  technique  will  be  analyzed  and  compared 
to  the  quad. 


Figure  20.  Parallel  Transistor  Network 
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Figure  Zl.  Series  Parallel  Transistor  Network 


A  continuation  of  this  idea  would  be  to  make  a  series  parallel  arrangement,  figure  21. 

A  less  obvious  design  would  be  to  redund  the  components  themselves.  For  example, 
the  transistor  can  fail  in  open  or  short.  The  quad  approach  would  yield  figure  22. 


Figure  2Z.  Transistor  Quad 


26 


ASD-TDR-62-1072 

Failure  mode  analysis  will  indicate  whether  the  dashed  line  should  remain  or  be  re¬ 
moved.  Before  a  circuit  can  be  quaded  on  a  cmnponent  level  knowledge  of  the  failure  modes 
of  the  components  must  be  possessed.  Knowing  the  A  and  B  figures  we  can  determine  the 
most  reliable  network  configuration  for  a  particular  component.  For  any  component  we 
have  the  choice  of  a  parallel,  series,  series  parallel,  or  parallel  series  network.  Table  5 
is  a  tabulation  of  failure  mode  data  for  typical  electronic  components.  The  data  is  used  to 
illustrate  the  method  developed  in  this  report.  To  design  a  quad  using  particular  compo¬ 
nents,  if  it  is  at  all  possible,  use  data  based  upon  life  tests  on  that  component.  This  dau 
would  be  far  superior  to  table  5.  The  relative  size  of  A  and  B  is  the  most  important. 

Going  back  to  figure  22  the  question  was  raised  as  to  the  line  connecting  the  parallel 
branches.  Table  5  gives  an  A  of  0.84  for  the  transistors  tested.  Figure  IS  shows  that  the 
series-paraliel  network  is  more  reliable  than  the  parallel  network.  The  concept  of  images 
as  developed  earlier  in  the  report  coupled  with  table  5  tells  us  that  the  parallel  series  is 
less  reliable  than  the  series  parallel.  Therefore,  the  line  remains  in. 

Resistors  and  inductors  are  assumed  to  fail  only  in  open,  never  in  short.  Capacitors 
are  assumed  to  fail  only  in  short,  never  in  open.  Figure  13,  plot  of  reliability  of  several 
networks  for  A  »  1.0,  B  >  0,  shows  that  the  parallel  network  is  more  reliable  than  the 
single  unit  or  the  series  parallel  for  the  resistor.  This  implies  that  for  the  capacitor  the 
series  network  is  more  reliable  than  the  single  unit  or  the  parallel  series. 

To  quad  the  components  of  figure  19  using  the  data  on  table  5,  figure  23  results. 


Table  5  Failure  Data 


Component 

Number 
Tested 
(X  103) 

Failures 

Short  Open 

N(F) 

N^O) 

N(F) 

Failure* 

Rate 
(X  10^) 

Transistors 

98 

79 

423 

.16 

.84 

0.03 

Diodes 

447 

67 

348 

.16 

.84 

0.2 

Capacitors 

215 

3 

0 

1 

0 

0.09 

Resistors 

500 

0 

0 

-- 

— 

0.014 

Inductor 

— 

— 

-- 

— 

— 

0.001 

a-NM  b-^ 

N  (F)  N  (F) 

•The  failure  rate  information  was  taken  from  ASD  Report  61-580. 


We  desire  to  derive  an  equation  which  relates  probability  of  success  as  a  function  of 
time  for  figure  23.  Figure  24  represents  figure  23  where  blocks  1  and  111  are  resistor 
networks  3  and  4.  Block  11  is  the  remainder. 
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Figure  Z3.  Quad  Network 
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Figure  24  -  Simplified  Network 


The  probability  of  success  of  figure  24  is 
Pg  -  P(l)  .  P(1I)  .  P(lll) 


(57) 


P(l)  -  P(lll)  -  1  -  (l-e‘*/^V  (58) 


P(l)  -  P(lll)  >  2  e**''^*^  -  (59) 

Equation  (58)  is  the  probability  of  success  of  a  parallel  network,  equation  (53),  with 
A  *  1,  B  »  O. 

Block  11  is  the  transistor  quad  with  the  necessary  input  and  bias  networks,  see  figures 
22  and  23.  The  first  problem  is  to  derive  the  probability  that  one  transistor  ensemble 
will  open  and  the  probability  that  one  transistor  ensemble  will  short.  Each  ensemble  con¬ 
sists  of: 


Item 

Quantity 

Components 

Transistors 

1 

1 

Parallel  resistor  network 

2 

2 

Parallel  inductor  network 

1 

2 

Series  capacitor  network 

1 

2 

Series  parallel  diode  network 

1 

4 

The  events  which  will  cause  an  apparent  short  across  terminal  a-b,  transistor  1  in 
figure  23  will  be  tabularized. 


Table  6.  Events  Causing  Shon 


Events 

Symbol 

Probability 

Basic 

Equation 

Transistor  shorts 

qs(T) 

B.j,(l  -  e'^^'^) 

44 

Capacitor  network  shorts 

(1  - 

54 

Diode  network  shorts 

qs(CR) 

(l-[l-B^j^(l-e‘‘/’^^^12)= 

56 

For  the  ensemble  to  fail  in  open  one  of  the  following  events  must  occur. 
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Table  7.  Events  Causing  Open 


Events 

Symbol 

Probability 

Basic 

Equation 

R^  network  opens 

V^> 

(1  - 

53 

R^  network  opens 

VS) 

(1  - 

53 

Inductor  network  opens 

%(L) 

(1  - 

53 

Transistor  Opens 

%(r) 

43 

Diode  network  opens 

V^r) 

1  -  -  e''/™)=]» 

55 

By  listing  the  short  events  the  probability,  QS,  that  one  transistor  ensemble  will  short 
is  calculated  by  summing  the  probability  of  occurrence  of  all  disjoint  short  events. 

QS  -  qg(T)  +  qg(Cj)  +  yT)  q^(Cp 

•VS  >  V^i^  •  % 

+  q^(CR)  qg(C^)  q^CD 

An  alternate  method  is  to  calculate  the  probability.  1^,  that  the  ensemble  will  not  short. 
Pg  is  the  product  of  the  individual  “not  probabilities”.  1^  is  the  probability  that  the  ca¬ 
pacitor  network  will  not  short,  that  the  transistor  will  not  short,  and  that  diode  network 
will  not  short. 

Pg  =  [1  -qg(T)]  ’  [1  -qg(Cj)l  .  [l-qg(CR)]  (61) 

The  probability,  QS,  of  short  is 

QS  -  1-P^  .  l-rl-qg(T)l  .  [l-qg(C^)]  •  ri-qg(CR)1  (62) 

The  reader  can  expand  62  to  show  the  identity  with  60. 

To  sum  up  all  the  probabilities  in  table  7  as  we  did  with  table  6  would  yield  an  equation 
similar  to  equation  (60)  but  with  3l  terms.  Using  the  method  to  develop  equation  (62)  the 
probability  of  the  transistor  ensemble,  QO,  opening  is 

QO  -  l-r  l-q^(r;1  •  ri-q^(L)]  .  [l-q^(CR)l  .  [l-q^j(R)]»  (63) 

A  series  parallel  network  with  known  probabilities  of  opening  and  shorting  QO  and 
QS  can  be  constructed.  See  figure  25. 
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Figure  25.  Tranaistor  Ensemble 

This  looks  very  much  the  same  as  the  network  in  figure  11  which  had  a  probability  of 
short,  q^,  and  probability  of  open,  q^,  and  a  probability  of  success  equation 

This  equation  cannot  be  used  on  figure  25.  The  problem  is  that  in  equation  (31),  q^ 
and  q  are  mutually  exclusive  events.  Both  a  short  and  an  open  cannot  occur  in  the  rame 
element. 

If  the  blocks  in  figure  25  represented  just  transistors  then  equation  (31)  is  valid.  If  QS 
is  probability  of  short  and  QO  is  probability  of  open  the  general  equation  for  the  term  re¬ 
lating  the  probability  of  either  event  or  both  occurring  in  one  block  is 

Q(0  +  S)  -  QO  +  QS  -  Q  (O.  S)  (64) 

Now  Q(0,  S)  is  a  joint  or  conditional  probability.  In  the  case  of  mutually  exclusive 
events  this  term  is  zero.  Whether  the  events  are  mutually  exclusive  or  not  Q(0  +  S)  must 
be  between  zero  and  one. 

0<Q(0  +  S).Q0  +  QS-Q(0,  S)<1  (65) 

If  it  can  be  shown  that  the  sum  of  QO  and  QS  for  figure  25  exceeds  one,  then  the  events 
must  not  be  mutually  exclusive. 

To  show  that  QS  approaches  1  as  time  becomes  quite  large,  it  can  be  shown  that  one 
term  of  equation  (62)  approaches  zero.  For  example 

(1  -  q^  (Cj))  -  1  -  (1  -  o  as  t  ^  -  (66) 

Therefore  QS  -  1  as  t  ->  o 

Similarly  QO  -  1  as  t  -  * 

Therefore  QS  +  QO  -  2  as  t  -  » 

Equation  (31)  can  be  modified  to  account  for  the  fact  that  q^  and  q^  are  not  mutually 
exclusive.  This  is  done  by  writii^  the  right  hand  side  of  equation  (3irthus: 

Pg  ”  1  -  (2q^»  -  q^*)  -  n  -  (l-q^)-  (67) 

The  probability  of  failure  due  to  opens,  QOO,  is 

QOO  -  (Zq^®  -q^,*)  (68) 
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The  probability  of  failure  due  to  shorts,  QSS,  is 

QSS  -  [1  -  (1 (69) 

Since  QSS  and  QOO  are  not  mutually  exclusive,  the  probability  of  failure  of  the  quad 
can  be  written  as 


Q  - 

QOO  +  QSS  -  QOO  •  QSS 

(70) 

The  probability 

of  success  is  then 

P  - 

1  -Q 

(71) 

P  - 

1  -  QOO  -  QSS  +  QOO  .  QSS 

(72) 

P  - 

1  -  (2%“  HI  - 

(73) 

a 

(l-q^>)»  -  !)•  [l-d-q^)*!* 

(74) 

a 

(l-q^>)»  -(1  -q^»)>  .  ri-(l  -qg)*)* 

(75) 

p  - 

{l-  ri-(l-qg)»]»}(l-q^»)» 

(76) 

Equation  (76)  is  used  to  evaluate  the  reliability  of  figure  25  which  is  block  11  of  figure 
24. 


CONCLUSIONS 

The  design  engineer  can  use  these  methods  to  predicate  the  reliability  of  redundant 
networks.  He  can  choose  the  network  which  yields  the  level  of  reliability  needed  without 
undue  complexity.  The  design  engineer  would  not  design  a  two  kilowatt  transmitter  when 
5(X)  watts  will  suffice  and  he  would  not  design  equipment  with  a  higher  reliability  than  is 
necessary. 

To  improve  the  reliability  of  the  large  airborne  computer  mentioned  earlier,  not  every 
circuit  should  be  made  quad  redundant.  Those  circuits,  which  by  their  nature  lend  them¬ 
selves  to  redundancy,  should  be  redunded  first;  the  resulting  reliability  calculated,  and 
further  work  done  as  necessary. 

Figure  26  is  the  probability  of  success  plot  of  the  four  networks  discussed  in  the  re¬ 
port.  The  results  are  what  was  expected.  The  quad  is  best  followed  by  the  series-parallel, 
parallel,  and  lastly  the  non-redundant  circuit.  What  purpose  is  this  report  if  the  results 
were  known  beforehand?  Previous  to  this,  no  one  knew  how  much  better  the  quad  was  over 
the  other  circuits.  It  is  this  ability  of  being  able  to  predicate  the  improvement  in  relia¬ 
bility  which  makes  this  work  worth  the  effort.  Furthermore,  the  quad  has  been  analyzed 
rigorously  knowing  that  components  can  fail  in  two  modes  as  opposed  to  failing  in  one  as 
has  been  the  case  in  previous  investigations. 
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Figure  26.  Redundant  Network  Probability  of  Success  versus  Time 
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Figure  27  shows  the  relative  effects  of  redundancy  upon  large  electronic  systems.  The 
1000  and  5000  curves  refer  to  a  system  employing  1000  or  5000  transistor  networks.  Each 
transistor  network  is  comprised  of  'he  same  elements  as  in  the  impedance  transformer. 
The  curves  demraistrate  the  effect  of  multiplying  a  number  less  than  one  a  large  number 
of  times.  The  probability  of  success  of  the  1000  unit  system  is  the  probability  of  success 
of  the  basic  unit  raised  to  the  1000th  power.  The  quad  becomes  very  superior  to  the  non- 
redundant  network  while  the  series  parallel  unit  lies  somewhere  in  between.  The  5000 
unit  is  not  an  unrealistic  size  as  the  Air  Force  has  an  airborne  computer  somewhat  larg¬ 
er  than  this  presently  in  production.  The  decision  to  use  the  series  parallel  or  quad  for  a 
particular  network  depends  upon  the  relative  difficulty  in  designing  and  fabricating  that 
network. 
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RECOMMENDED  AREAS  OF  FUTURE  INVESTIGATION 

The  application  of  redundancy  to  electronic  design  is  limited  by  our  ability  to  design 
redundant  networks.  The  input-output  characteristics  may  be  such  that  active  redundancy 
cannot  be  used.  However,  most  pulse  or  digital  circuits  are  easily  adapted  to  redundant 
configuration.  Robert  Lyons  discusses  redundant  design  in  his  report  ‘  ‘The  Use  of  Triple 
Modular  Redundancy  to  Improve  Computer  Reliability."  While  triple  modular  redundancy 
is  not  the  same  as  component  redundancy,  Lyons’  reconrunendations  are  similar  to  this 
author's.  Namely,  that  the  design  engineer  must  design  reliability  into  the  network  primar¬ 
ily  by  using  designs  based  upon  probability  theory.  Pulse  and  digital  circuits  must  be  in¬ 
vestigated  with  this  concept  in  mind. 

A  second  area  of  investigation  concerns  the  paralleling  and  serializing  of  electronic 
components.  In  building  the  quad  it  was  found  that  the  needed  value  of  inductance  of  two 
paralleled  inductors  could  be  had  when  the  mutual  inductance  was  additive.  If  a  coil  then 
failed  in  open,  the  only  mode  of  failure,  the  change  in  inductance  was  not  excessive.  For 
example,  the  average  value  of  the  eight  coils  was  172  microhenrys.  The  average  value  of 
the  paralleled  inductors  was  120  microhenrys.  The  change  from  120  to  170  microhenrys 
was  not  so  great  as  to  degrade  performance.  Along  this  same  line,  it  might  be  necessary 
to  use  three  resistors  rather  than  two  in  order  to  reduce  the  net  change  in  resistance 
when  an  open  occurs.  Investigation  along  these  lines  would  be  very  fruitful. 
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